This threat involves a malicious npm package named 'statist-browser-typed-client-eventea.projects.pwahelp' at version 35.8.0. According to analysis from Amazon Inspector, the package lacks direct code paths for stealing secrets or executing remote content, but the GHSA malware advisory indicates that installation results in full system compromise. The package may have installed additional malicious components or backdoors, making the host untrustworthy. Immediate secret rotation and package removal are recommended, though full remediation may require more extensive incident response.

Systems with this package installed are considered fully compromised, implying potential unauthorized access and control by an attacker. All secrets and keys stored on the affected system are at risk and should be rotated from a secure environment. Removal of the package does not guarantee complete eradication of malicious artifacts or backdoors introduced during installation.

Remove the malicious package immediately. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Conduct a thorough incident response to identify and remediate any additional malicious software or persistence mechanisms that may have been installed. There is no official patch or fix available; mitigation relies on removal and secret rotation.